Dashboard · Configuration
Webhooks
Registering an endpoint, reading deliveries, and verifying signatures.
Pushing events to your system instead of polling for them.
Registering an endpoint#
Declare your URL and choose which event types to receive. Each webhook has a signing secret (whsec_…), shown once.
Always verify the signature#
A webhook endpoint accepts POSTs from anyone who finds its URL. Without signature verification you are letting strangers write into your system.
Header, computation and replay detail: Webhook payload.
The delivery list#
Every delivery is recorded: when, the status your endpoint returned, the duration, and the retry count. Open a row to see the payload sent and the response received.
This is where "did you send it" gets a definitive answer instead of a two-sided argument.
The guard on our side#
Every request to a customer-supplied URL goes through an address check, and the address is checked inside the socket's own DNS lookup.
The reason: a hostname can resolve to an internal address, and 169.254.169.254 is the cloud providers' metadata endpoint. Checking first and connecting after leaves the case where DNS answers differently between the two.
When your endpoint goes down#
A failed delivery is retried. Sustained failure shows up in the list, and is exactly what you want an alert on.